fix: capture large brand pages and add Xquik preset

[kriptoburak]

Problem and value

Fixes #102.

brands capture read the whole HTML response against its 256 KiB cap before inspecting icon metadata. A site with a small head and a large body failed before Archify reached valid icon candidates.

This change also adds Xquik to the maintained Archify brand catalogue. Users can resolve xquik, xquik-api, xquik.com, or docs.xquik.com. Archify renders the bundled public vector without a network capture.

Scope

• Stop the bounded HTML read after a complete </head>.
• Recognize a closing tag split across response chunks.
• Keep rejecting any head larger than 256 KiB.
• Add the public Xquik vector, aliases, domains, and provenance.
• Return catalogue provenance in preset capture receipts.
• Cover lookup, capture, rendering, and the installed package.
• Rebuild the tracked Skill archive from the final source.
• No unrelated changes.

Stability impact

• Existing brand IDs and remote capture receipts remain compatible.
• Unknown-site capture keeps its DNS, redirect, deadline, format, digest, and size checks.
• Pages without a complete head inside the limit still fail closed.
• The Xquik preset removes network access from Xquik lookup and rendering.
• Reverting the single commit removes the full change.

Current-base repair

• Rebased the single signed commit onto aab9f85659ada148a9232a5129726e395edb4370.
• Resolved the only conflict by rebuilding archify.zip from the combined source.
• Used the repository's canonical deterministic builder with Node 22.23.2.

Tests run

• node --test test/brand-marks.test.mjs: 28 passed, 0 failed.
• npm test: 719 passed, 0 failed, 18 correctly skipped.
• Extracted archify.zip package smoke: passed on macOS.
• Second archive build matched archify.zip byte-for-byte.
• npm run check:brand-marks: passed.
• git diff --check upstream/main...HEAD: passed.
• GitHub reports the rebased commit signature valid and verified.

The focused regression splits </head> across 2 chunks, then sends a body over 300 KiB. A second regression confirms an oversized head still fails. The Xquik regression covers domain lookup, preset capture, provenance, rendered SVG metadata, and the installed package.

Visual evidence

Real Chrome visual-check passed at 1440×900, 1600×1000, 1920×1080, and 2048×1320. The Xquik mark stays visible and clear of labels, routes, the legend, and viewer controls.

Generated artifacts

Rebuilt archify.zip from the current source after rebasing onto main. The archive contains 70 tracked package files. The extracted package smoke passed without node_modules.

Checklist

• I kept the fix and integration in one brand-capture path.
• I ran the focused and full test suites.
• I added regression coverage for each behavior change.
• I rebuilt and smoke-tested the package archive.
• I reviewed the final public diff and visual artifacts.
• I removed secrets, private repository content, and customer data.

[kriptoburak]

Resolved the live archify.zip conflict in a2844a6b by rebasing onto current main and rebuilding the archive with the canonical Node 22 toolchain.

• 28 focused brand tests passed.
• Full suite: 719 passed, 18 skipped, 0 failed.
• Extracted package smoke passed.
• A second archive build matched byte-for-byte.
• GitHub verifies the signed commit.

The PR is now one commit over aab9f856 with no source conflict.